redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity
alistair23-linux/net/bluetooth
History
Anmol Karn 5cf3c2e789 Bluetooth: Fix null pointer dereference in hci_event_packet() 
[ Upstream commit 6dfccd13db ]

AMP_MGR is getting derefernced in hci_phy_link_complete_evt(), when called
from hci_event_packet() and there is a possibility, that hcon->amp_mgr may
not be found when accessing after initialization of hcon.

- net/bluetooth/hci_event.c:4945
The bug seems to get triggered in this line:

bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;

Fix it by adding a NULL check for the hcon->amp_mgr before checking the ev-status.

Fixes: d5e911928b ("Bluetooth: AMP: Process Physical Link Complete evt")
Reported-and-tested-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f
Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2020-12-30 11:51:05 +01:00
..
bnep treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234 2019-06-19 17:09:07 +02:00
cmtp treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
hidp Bluetooth: hidp: Fix assumptions on the return value of hidp_send_message 2019-09-06 15:55:40 +02:00
rfcomm Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl 2020-04-13 10:48:13 +02:00
6lowpan.c Bluetooth: add a mutex lock to avoid UAF in do_enale_set 2020-08-19 08:15:59 +02:00
Kconfig bluetooth: switch to AES library 2019-07-26 14:58:12 +10:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
a2mp.c Bluetooth: A2MP: Fix not initializing all members 2020-10-17 10:11:22 +02:00
a2mp.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284 2019-06-05 17:36:37 +02:00
af_bluetooth.c net: use skb_queue_empty_lockless() in poll() handlers 2019-10-28 13:33:41 -07:00
amp.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284 2019-06-05 17:36:37 +02:00
amp.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284 2019-06-05 17:36:37 +02:00
ecdh_helper.c Bluetooth: let the crypto subsystem generate the ecc privkey 2017-10-06 20:35:47 +02:00
ecdh_helper.h Bluetooth: let the crypto subsystem generate the ecc privkey 2017-10-06 20:35:47 +02:00
hci_conn.c Bluetooth: Disconnect if E0 is used for Level 4 2020-10-17 10:11:22 +02:00
hci_core.c Bluetooth: Allow combination of BDADDR_PROPERTY and INVALID_BDADDR quirks 2020-02-01 09:34:50 +00:00
hci_debugfs.c Bluetooth: Add debug setting for changing minimum encryption key size 2019-08-17 13:54:40 +03:00
hci_debugfs.h Bluetooth: Provide option to enable/disable debugfs information 2015-02-15 18:54:13 +02:00
hci_event.c Bluetooth: Fix null pointer dereference in hci_event_packet() 2020-12-30 11:51:05 +01:00
hci_request.c Bluetooth: Fix advertising duplicated flags 2019-12-31 16:44:33 +01:00
hci_request.h Bluetooth: Use controller sets when available 2019-07-06 15:38:18 +02:00
hci_sock.c Bluetooth: Fix race condition in hci_release_sock() 2020-02-05 21:22:42 +00:00
hci_sysfs.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-11-04 09:26:51 +09:00
l2cap_core.c Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel 2020-10-17 10:11:22 +02:00
l2cap_sock.c Bluetooth: Only mark socket zapped after unlocking 2020-10-29 09:58:06 +01:00
leds.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
leds.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
lib.c Bluetooth: make baswap src const 2017-09-01 22:49:47 +02:00
mgmt.c Bluetooth: MGMT: Fix not checking if BT_HS is enabled 2020-10-17 10:11:22 +02:00
mgmt_util.c networking: make skb_push & __skb_push return void pointers 2017-06-16 11:48:40 -04:00
mgmt_util.h Bluetooth: Add generic mgmt helper API 2015-03-17 18:03:08 +01:00
sco.c net: rework SIOCGSTAMP ioctl handling 2019-04-19 14:07:40 -07:00
selftest.c Bluetooth: Fix compiler warning with selftest duration calculation 2017-10-06 21:49:13 +03:00
selftest.h Bluetooth: Add support for self testing framework 2014-12-30 08:53:55 +02:00
smp.c bluetooth: switch to AES library 2019-07-26 14:58:12 +10:00
smp.h Bluetooth: SMP: fix crash in unpairing 2018-09-26 12:39:32 +03:00